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1.0 SUMMARY 


This report covers the testing of the Test ACT System conducted under the final 
program element of the Integrated Application of Active Controls (I A AC) Technology 
to an Advanced Subsonic Transport Project, a part of the NASA Energy Efficient 
Transport Technology Program. It documents the validation testing of the Test ACT 
System, and limited testing of a direct drive valve actuation concept interfaced with 
the modified Test ACT System electronics. 

The Test ACT System as initially designed and built was a flight-worthy experimental 
implementation of selected active control functions (pitch augmented stability and 
wing load alleviation) and a pitch axis fly-by-wire control system. It used force- 
summed secondary servos to command the elevator power control units. The system 
was mounted in consoles so it could be readily installed and tested in the 757 flight 
test airplane. 

The validation laboratory testing was accomplished in the Boeing Digital Avionics 
Flight Controls Laboratory. The Test ACT System was connected with the laboratory 
through a work station interface. Open loop hardware and open loop software tests 
were accomplished up to the time the program was redirected to examine a direct 
drive valve actuation concept. The few significant problems that were identified were 
such that the testing (including flight) could proceed, but changes would be 
implemented in a production form of the system. The problems had to do with the 
system status display and response to power failures and dropouts. In general the 
hardware was effective and all major functions worked well. The software tests 
showed that the software was well designed and implemented, and only minor problems 
were uncovered. 

In order to examine a new actuation concept, the system was modified to command 
elevator deflection through a direct drive valve instead of the originally selected 
secondary servos. The results were encouraging, but several problem areas (non- 
linearities due to valve gain and valve friction) would require further work before the 
concepts as examined in this test would be ready for commercial applications. 
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Due to the NASA decision to terminate funding for the IAAC Test ACT System work, 
this document constitutes the final technical report on the IAAC Project part of 
contract NAS1-15325. 

The Test ACT System architecture continues to appear promising for active control 
and/or fly -by-wire applications in systems that must be immune to worst case generic 
digital faults, and be able to tolerate two sequential nongeneric faults with no 
reduction in performance. The challenge in such an implementation would be to keep 
the analog element sufficiently simple to achieve the necessary reliability. 

It is recommended that NASA resume support to the development of advanced flight 
control concepts suitable for application to commercial transport airplanes, as was 
being done under the IAAC Project. Advanced systems for these commercial flight 
crtitical applications must meet stringent reliability/availability requirements that are 
beyond those achievable by current military systems. NASA sponsorship is a necessary 
element of the needed technical advances and the subsequent demonstration of 
appropriate system or system elements. 
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2.0 INTRODUCTION 


2.1 I A AC PROJECT OVERVIEW 

The Integrated Application of Active Controls (IAAC) Technology to an 
Advanced Subsonic Transport Project has had three major objectives. The first 
objective was assessment of benefits to a commercial transport of the full 
application of active controls that are designed into the airplane from the 
beginning of a production program. The second objective was identification of 
the risks associated with the use of Active Controls Technology (ACT). The 
third objective is reduction of these risks, through test and evaluation, to a level 
commensurate with commercial practice to the degree possible within the 
project's funding iimitations. 

This project (ref. 1) was organized into three major elements, as shown at the 
top of Figure 1. The first major element, Configuration/ACT System Design and 
Evaluation, included establishment of the design criteria appropriate for an ACT 
airplane (designed from the outset to depend upon active controls), design of an 
ACT airplane configuration to meet the selected criteria, design of an active 
controls system based upon current technology, and selection and evaluation of a 
Final ACT airplane configuration. The results of these studies are documented 
in References 2, 3, 4, 5, 6, and 7. 

In parallel with these tasks, the second major element, Advanced Technology 
ACT Control System Definition (fig. 2) included exploration of optimal control 
synthesis methods, alternative means of implementing the ACT functions using 
advanced technology, and an examination of the integration of ACT, control, and 
guidance functions. The results of these studies are documented in 
References 2, 3, and S. 

The final major element, Test and Evaluation, is expanded in Figure 3. The 
components of this element address reduction of the risk associated with 
implementation of active controls on a commercial transport. For example, the 
piloted simulation evaluation (ref. 9) examined the longitudinal handling 
qualities of a representative medium range transport airplane (based upon 
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Figure 2. Advanced Technology ACT Control System Definition Element 
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predicted characteristics of the Boeing model 757 ) at various levels of 
instability, with two different augmentation schemes. The software- 
implemented fault tolerance (SIFT) and fault tolerant multiprocessor (FTMP) 
projects sponsored by NASA Langley Research Center (currently under test in 
the Langley AIRLAB) were followed and the resulting concepts considered 
throughout the IAAC Project; however they did not directly influence control 
system architecture developed for the Test ACT System. 

The ACT System hardware/software acquisition and test component (shown at 
the bottom of Fig. 3) was originally intended to cover the design, fabrication, 
and/or acquisition of a test system for laboratory test and flight test. Due to a 
reduction in NASA funding of the project, NASA, Boeing, and Collins, 
reevaluated the task and subsequently reduced its scope, 'work completed for 
this component includes selection of a test airplane and system concept, design 
and fabrication of the Test ACT System electronic elements, and initial 
laboratory tests and flight test planning. These items are reported in Reference 
10. Tasks that were canceled include all phases of flight testing and portions of 
the laboratory evaluation and testing. 

Subsequent to publication of the project plan, it was concluded that it would be 
inappropriate to conduct the wind tunnel tests described in that plan under NASA 
funding. The lab testing of SIFT/FTMP uitrareliable computer concepts in the 
BCAC Digital Avionic Flight Controls Laboratory (DAFCL) was also considered 
to be beyond the scope of this work. Consequently, the elements of Figure 3 
shown in subdued print were deleted from the plan. 

2.2 TEST ACT SYSTEM VALIDATION OVERVIEW 

This document covers the latest phase of the IAAC program, the Test ACT 
System Validation testing. The Test ACT System is described in Reference 10. 
That report covered the design, acquisition, and installation in the Boeing 
DAFCL of the Test ACT System. Parts of that system description document are 
summarized in Section 4 and Section 5 to properly set the stage for reporting the 
test results herein. Lack of NASA funding for the flight test phase and portions 
of the scheduled laboratory testing led to the decision to use the Test ACT 
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System for alternate studies. It was mutually agreed that the design, and testing 
of a new technology fly-by-wire (FBW) actuation system in the laboratory using 
the Test ACT System, with some modifications, would have merit in providing an 
opportunity to gain experience and gather data on a technologically new 
actuation system concept. An actuation system incorporating a direct drive 
valve (DDV) is a candidate for a FBW system and was chosen for the modified 
Test ACT System testing in the DAFCL. 

The test results are reported in two sections; 

1. Tests of the Test ACT System as initially planned and designed for flight 
test using force-summed secondary actuators to command the 757 test 
airplane elevators; 

2. Test of the FBW actuation system using the Test ACT System, modified 
by revising the mechanical section of the system and incorporating the 
direct drive valve. 

Because of resource limitations, testing was reduced in scope to include only 
open loop tests of the system hardware and software. At the time of this report, 
NASA funding is not available to allow completion of the remaining scheduled 
laboratory testing or to execute the flight test phase. 

An overall review and summary of the IAAC project is published in Reference 

11 . 
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3.0 SYMBOLS AND ABBREVIATIONS 


3.1 DEFINITIONS 

In this report certain common words are given special meaning not contained in their 
dictionary definitions. These singular usages are defined below. The following two 
adjectives categorize the flight safety implications of control functions as described in 
FAA Advisory Circular No. 25.1309-1 (ref. 12). 

Critical — any function whose loss can result in an immediate, unconditional flight 
safety hazard. All control system elements providing such functions must be 
operating for continued safe flight. 

Essential — any function whose loss can result in a potential hazard, that is 
avoidable through appropriate pilot action. Failure of control system elements 
prov ding such functions can be accommodated without impacting flight safety. 

Table 1 relates these criticality levels to the original I A AC levels and the reliability 
requirements. 

The FAA criticality designations are used in this document. However, for continuity 
the ACT control system terminology used throughout references 2 through 10 will be 
retained. For example the Test ACT System essential analog computers implement 
"critical functions" (FAA AC 25.1309-1), whereas the Test ACT System primary 
digital computers implement the "essential functions". 
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Table 1. Test ACT Criticality Levels and Associated Reliability Requirements 


Probability of 

Original IAAC 

FAA AC-25-1309 

Test ACT System 

Function Loss 

Criticality 

Criticality 

Element 

(On the order of) 

Designation 

Designation 

Designation 

Extremely 

Improbable 
(1 x 10-9)* 

Crucial 

Critical 

Essential 

Improbable 
(1 x 10-s)* 

Critical 

Essential 

Primary 


* Probability of loss of function in a flight of 1 hour duration. 
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The following two systems are reported on in this document. 


Test ACT System -the ACT System that is the main subject of this report, is 
described in greater detail in Ref. 10. Although its Primary sensor redundancy is 
not sufficient to meet production system reliability standards, it is sufficiently 
reliable for flight test and evaluation. 


Modified Test ACT System -the ACT Test System with active control computers 
(ACCs) modified to interface with a fly-by-wire actuation system concept 
incorporating a direct drive valve (DDV). 
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3.2 ABBREVIATIONS 


A 

ampere 

ac 

alternating current 

ACC 

Active Controls Computer 

ACT 

Active Controls Technology 

AFDS 

Autopilot Flight director system 

amp 

amplifier 

ARINC 

Aeronautical Radio Incorporated 

CAPS 

Collins Adaptive Processing System 

eg 

center of gravity 

CMD 

command 

CPU 

central processing unit 

CRT 

cathode ray tube 

CSEU 

Control System Electronics Unit 

DAC 

digitial to analog conversion 

D/A 

digital to analog 

DADC 

Digital Air Data Computer 

DAFCL 

Digital Avionics Flight Controls Laboratory 

dB 

decibel 

dc 

direct current 

deg 

degree of arc 

DDM 

Direct Drive Motor 

DRO 

Design Requirements and Objectives 

DDV 

Direct Drive Valve 

DTP 

Detailed Test Procedure 

EET 

Energy Efficient Transport 

EHSV 

electrohydraulic servovalve 

EMI 

electromagnetic interference 

ESS 

Essential 

FAA 

Federal Aviation Administration 

FBW 

fly by wire 
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FC 

FCC 

FFWD 

FSEU 

FTMP 

FTP 

HZ 

H/W 

IAAC 

in. 

I/O 

IRS 

IRU 

kPa 

L 

lbf 

LRU 

LVDT 

mA 

ms 

mm 

MTBF 

NZB 

NASA 

Pa 

PAS 

PCU 

PFTP 

P/N 

psi 

R 

RAM 

RF 


Flight Change 

Flight Control Computer 

feed forward 

Flap/Slat Electronics Unit 

Fault Tolerant Multiprocessor 

Flight Test Programmer 
« 

hertz 

hardware 

Integrated Application of Active Controls Technology to an Advanced 

Subsonic Transport Project 

inch 

input/output 

Inertial Reference System 
Inertial Reference Unit 
kilopascal 
left 

pound-force 

line replaceable unit 

linear variable differential transformer 

milliamperes 

millisecond 

millimeter 

mean time between failures 
normal body acceleration 

National Aeronautics and Space Administration 
pascal 

pitch-augmented stability 
power control unit 
Preflight Test Panel 
part number 

pounds force per square inch 
right 

random-access memory 
radio frequency 
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RFCSHL 

Renton Flight Control Systems Hydromechanical Laboratory 

RFSC 

Renton Flight Simulation Center 

SCD 

Specification Control Drawing 

SIFT 

Software-Implemented Fault Tolerance 

S/N 

serial number 

SSFD 

signal selection and fault detection 

S/W 

software 

TAC 

Test ACT Console 

TACP 

Test ACT Control Panel 

TED 

trailing edge down 

V 

volts 

WLA 

wing-load alleviation 

WSI 

work station interface 
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3.3 SYMBOLS 


F 

L 

S / 

K 

K, 




'SA 

C VP 


K 

K 

K 

K 

K 


VPD 

SP 

SPD 

CS 

EQ 


C A T H 

C S T H 


MVP 


K 
K A 

! th 

k mc 

ESS 


CMD 


filter 

limiter 

servo amplifier gain 

motor (DDM) gain 

valve (DDV) gain 

surface actuator gain 

valve (DDV) position LVDT gain 

valve (DDV) position demodulator gain 

surface position LVDT gain 

surface position demodulator gain 

servo comparator gain 

equalization gain 

servo comparator monitor 

amplifier comparator monitor 

amplifier comparitor threshold 

servo comparator threshold 

modeled valve position gain 

amplifier gain 

current equalization threshold 
modeled current gain 
Essential elevator command 
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4.0 SYSTEM DESCRIPTION 


4.1 SUMMARY 


The Test ACT System as described in Reference 10 is an active controls technology 
(ACT) system implementing pitch augmented stability, pitch fly-by-wire (FBW), and 
wing load alleviation, which includes both maneuver load control and gust load 
alleviation. It was designed to be test flown in the Boeing 757-200 flight test airplane. 
The system consists of two major functional elements. The first, an ultrareliable 
quadruple analog core, called the Essential system, provides basic pitch augmented 
stability (PAS) and FBW, which are "critical" functions, and must be operational for 
safe flight. The second element of the Test ACT system is a quadruple set of digital 
Primary computers with additional sensors and more comprehensive control laws. It 
provides scheduled stabilization and enhanced maneuver characteristics to yield Level 
1 handling qualities as described in Figure 4. Loss of these noncritical functions will 
not necessarily result in a threat to flight safety, but could lead to a potential flight 
hazard that could be avoided through appropriate pilot action. 


The electronic equipment is mounted in consoles (fig. 5) so it can be readily tested in 
the laboratory and then moved into the airplane with a minimum of dismantling. The 
major hardware elements are: 


Console No. 1 

Left half 
Right half 


Hewlett Packard HP2645A terminal 
Three flight deck control panels (at the top) 

Four Collins adaptive processing system (CAPS) test 
adapters 


Console No. 2 

Left half 
Right half 


Four active control computers (ACCs) 

Four ACC breakout panels 

Power control panel (at the bottom) 


Figure 6 is a photograph of the system's electronic hardware, with the ACCs and the 
control panels in the background and the sensors in the foreground. The two units at 
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Adequacy for selected 
task or required operation 


Is it 


Deficiencies 

satisfactory 

without 

improvement? 

p 

l 

warrant 

improvement 


Aircraft Demands on the pilot in selected 

characteristics task or required operation 



Pilot Ha " d . infl 
.. qualities 

ratm9 level, 


Excellent-highly Pilot compensation not a factor 
desirable for desired performance 


Good-negligible Pilot compensation not a factor 
deficiencies for desired performance 


Fair-some mildly Minimal pilot compensation required 
unpleasant for desired performance 

deficiencies 



r 

Minor but 

Desired performance requires 

annoying 

moderate pilot compensation 

deficiencies 


Moderately 

Adequate performance requires 

objectionable 

considerable pilot compensation 

1 deficiencies 



Very objection- Adequate performance requires 
able but tolerable extensive pilot compensation 
deficiencies 


Is adequate 

performance 

obtainable 

with a 

tolerable 

pilot 

workload? 


Is it 

controllable? 


Pilot decisions 


Deficiencies 

require 

improvement 


Improvement 

mandatory 


Major Adequate performance not attainable 

deficiencies with maximum tolerable pilot compen- 

sation; controllability not in question 


Major 

Considerable pilot compensation 

8 

deficiencies 

required for control 


Major 

Intense pilot compensation 

9 

deficiencies 

required to retain control 



I Major Control will be lost during some 

deficiencies portion of required operation 


Figure 4. Cooper-Harper Pilot Opinion Rating Scale 
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Figure 5. Test ACT System Consoles 



See enlargement in Figure 7 
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Figure 6. Test ACT System Electronic Hardware 


the front of the photograph are quadruple-column force transducers; for laboratory 
operation they are mounted with an operating lever atop ACT Console No. 2 (they can 
be seen at the upper right of Figure 5), so that the lever serves as a simulated control 
column for the laboratory test. Figure 7 is a closeup of the three control panels. 

The Test ACT System was installed in a work station at the Boeing Digital Avionics 
Flight Controls Laboratory (DAFCL), as shown in Figure 8. The Test ACT System 
consoles are as shown at the left side of the figure. The three tall consoles at the 
right side of the figure are the work station interface (WSI) unit. In the first phase of 
testing, this equipment was run with the actuation function and the airplane actuators 
simulated electronically. In the second phase of testing, this electronic equipment was 
modified to integrate with a selected FBW actuation assembly, shown in Figure 9, 
including a direct drive valve (DDV) module and actuation loop. 
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Figure 7. Test ACT System Flight Deck Control Panels 
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Figure 8. Test ACT System Installation in DAFCL 
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Figure 9. Direct Drive Valve Actuation System Test Fixture 


4.2 TEST ACT SYSTEM 


Figure 10 is a block diagram of the Test ACT System architecture. The general 
arrangement of Figure 10 shows sensors situated at the left, the computers in the 
center, and the servoactuators at the right side. The Test ACT System is shown within 
the heavy dashed line to separate it from the airplane equipment with which it 
interfaces. The redundancy limitations of the Primary system are shown in the boxes 
representing 757 sensors at the left and the trim system at the bottom of the figure. 
Note that the Essential sensors for column force and dedicated pitch rate are 
quadruple. (The term "dedicated" distinguishes the quadruple pitch-rate gyro inputs, 
serving the Test ACT System only, from the lower reliability Primary pitch-rate 
signals coming from triple Inertial Reference Systems (IRS)). 

The autopilot Flight Control Computer (FCC) and the Control System Electronics Unit 
shown at the bottom of the diagram in Figure 10 are both control computers that are 
part of the existing airplane equipment. Similarly, the aileron and elevator power 
control units (PCUs), shown at the right side of Figure 10 are existing 757 equipment. 
Control and display panels and the system console are in the Test ACT System box at 
the upper left. For the sake of diagram clarity, all redundant connections, whether 
dual, triple, or quadruple, are represented by single lines. 

4.2.1 ESSENTIAL SYSTEM 

The Essential system, which must perform with extremely high reliability, comprises 
the column force sensors, dedicated pitch-rate sensors, Essential analog computers, 
and elevator secondary servos. This is the quadruple, simple, high-reliability system 
that always operates to provide acceptable airplane handling characteristics in the 
pitch axis, for all allowable center-of-gravity locations. The FBW function is 
generated by the column force sensors and a simple, dual-gain feedforward control law 
in the analog computers coupled to the servo controlling each elevator surface. Short- 
period pitch stability augmentation is provided by the pitch-rate gyros and a simple 
dual-gain feedback control law. Both of those control functions are available for safe 
flight if the entire Primary system fails. In normal operation, the Essential surface 
command includes a voted surface command from the Primary system commands to 
provide Level 1 handling qualities in pitch. By keeping the Essential system very 
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simple and free of elaborate gain schedules and reconfiguration provisions, the 

estimated reliability meets the flight critical system requirement (probability of 

-9 

function loss is less than 10 for a 1-hour flight). 

4.2.2 PRIMARY SYSTEM 

The Primary system uses the airplane sensors shown at the left in Figure 10, the wing 
accelerometers, the quadruple Primary digital computers, and the airplane trim 
system to provide speed stability augmentation, elevator offload, and wing-load 
alleviation. As shown in the diagram, the wing-load alleviation function is carried 
through computation of the servo command, which is monitored and made part of the 
redundancy management process in the computer; but no aileron secondary servos 
were planned for airplane installation. The test airplane does not have the full 
complement of Primary sensors; therefore, limited cross-strapping is required to 
provide each computer with direct coupling to a complete sensor set. For example, 
the center IRS is connected to two Primary computers. 

The Primary system also contributes to short-period pitch augmentation and the fly- 
by-wire feedforward control law; for the latter it requires column force sensor input. 
The dedicated column force sensors are hardwired to the Essential computers for 
reliability. Column force is a buffered output from the Essential computers to the 
Primary, so that a catastrophic failure in the Primary input system cannot affect the 
Essential column force input. 

The Primary computer is a minicomputer derived from the Collins FCC 701, which is 
the Autopilot/Flight Director System computer for the Boeing 757 and 767 airplanes. 
Its high throughput and memory capacity enable it to be programmed for these diverse 
functions: 

o Control laws for the active control and fly-by-wire functions listed above 
o Primary system redundancy management and reconfiguration control 
o Preflight test of the complete Test ACT System, including the Essential channels 
o Self -test and self-monitor functions 
o Sensor signal selection and failure detection 

o Flight crew communication and control via three flight deck panels 
o Maintenance interface via the Test ACT Console 
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Redundancy management design issues include the down-mode strategy for sequential 
failures in sensor sets; the choice made for the Test ACT System is "4-3-2-0"; that is, 
no operation on a sensor signal is allowed if only a single valid input is available. The 
Test ACT System has upmode capability, requiring a renewed valid signal from both 
inline monitor and comparison monitors. 

Preflight test control is another large assignment for the Primary computer. In the 
Test ACT System, the ultimate voting plane is the detent vote at the actuator force 
summing shaft. Proper detent operation is critical and a "soft detent" test must be a 
part of preflight. This requires that three Primary computers disengage their 
respective Essential servo actuators while the fourth Primary tests its associated 
actuator detent. Two solenoid valves in series provide redundant capability for servo 
shutdown. The detent comparator includes a means of Essential channel oscillatory 
failure detection by providing different set and reset time delays on the comparator. 

The "Test ACT Console" block in Figure 10 represents the Test ACT System structure. 
In the laboratory, the console is the housing and mounting for the entire system except 
the servos; in the test airplane it carries the entire system except the servos, the 
system sensors, and the three flight deck panels. This arrangement minimizes the 
interconnection changes needed in a move from laboratory to airplane. 

4.2.3 FEATURES OF THE ARCHITECTURE 

This section describes some architectural features of the Test ACT System that are 
not evident from the foregoing descriptive text and the block diagram shown in Figure 
10 . 


The Essential system provides a survivable core that enables the airplane to get home 
in case of any failure or failures within the digital Primary system. The Essential 
system was implemented in analog to achieve high reliability and functional isolation. 
The Primary system was implemented digitally to take advantage of greater 
processing capability and flexibility. Should the digital failure be in the form of a 
hardover signal, protection is afforded by the insertion of a limiter between the digital 
output and the pitch servo actuators, limiting the elevator command in all flight 
modes to less than that which would result in a normal acceleration of lg. 
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The simplicity of the analog Essential system, with its resultant low single-channel 
mean time between failure rate (MTBF greater than 10K hr), and careful avoidance of 
any path by which failure of one channel can contaminate another channel reduces the 
risk associated with FBW and active control implementation. Cross-channel 
communication implementation was found to be incompatible with these objectives. 
Therefore, the Essential system was selected to be brick-walled— that is, the channels 
must be isolated from one another through all electric paths. This requires that all 
monitoring is done inline rather than cross-channel, and all input voting must be 
performed individually in each channel. Monitors in the Primary system, on the other 
hand, depend heavily upon cross-channel comparison. 

In the Test ACT System configuration, as shown in Figure 10, the brick-walled 
separation of Essential channels is maintained throughout the electronics and ends at 
the output of the secondary servo actuators. Flere the four-channel outputs are 
force-summed in the shaft that controls the power control actuators driving the 
elevators. This is the final voting plane. 

Earlier IAAC studies indicated that the probability of a loss of function is less than 
10 -5 in a one-hour flight and could be met with a three-channel Primary system. 
However, all three channels must be available for dispatch, a stipulation that would 
affect schedule reliability. The preferred solution is a quadruple Primary system that 
can be dispatched with one channel down. 

Asynchronous operation of the redundant digital computers was chosen for this 
application. Low bandwidth inputs and high sampling rates minimize the time offset 
inherent in asynchronous operation systems. 

With the discussed architectural choice: 

o The system tolerates a worst -case common-mode digital fault 

o The system can tolerate any two sequential failures with no reduction in 
performance 
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o The high-reliability analog portion of the system is always on line and requires no 
switching 

o Digital computers are used for their unique control law and redundancy 
management capability 

o The concept provides very high fault isolation coverage 

In summary, the Test ACT System is hybrid and combines the safety of simple analog 
computers with the performance and versatility of digital computers. 
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4.3 MODIFIED TEST ACT SYSTEM 


The following is a description of the modified Test ACT System detailing the hardware 
changes required to interface the Test ACT System to a FBW actuation system 
featuring a direct drive valve (DDV) as the controlling element. The block diagram in 
Figure 11 shows the modified Test ACT System architecture. The changes from the 
Test ACT System architecture (fig. 10) consist of the removal of the elevator 
secondary servo-actuators and hydraulic PCUs and their replacement with DDV 
modules and hydraulic rams. Changes were limited to the actuation mechanism 
hardware and the ACC output and monitor sections. The test fixture used to develop 
and test this FBW actuation concept is described in Section 4.3.3. 

i. i i c\/c*rr , *« r*/x«,ir*rnx rvr't rr t r\n««rnT 
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As was done with the Test ACT System, a FBW actuation system concept was defined 
as a baseline for developing a FBW actuation integration test system for use in the 
DAFCL. Figure 12 is a diagram showing this baseline FBW actuation system concept. 
Four ACCs are utilized in the system, each having left and right output sections. The 
ACCs drive two DDV modules that in turn control the surface actuators. The diagram 
also shows two quadruple sets of linear variable differential transformers (LVDTs) 
providing feedback to the control computers for both valve position and surface 
position. Each of the two DDV modules is served by a separate output channel from 
each of the ACCs. 

Figure 12 shows the content of the DDV module made up of these elements: 

1. The direct drive motor (DDM) having four coils, one for each ACC. 

2. A triple tandem control valve (direct drive valve) to serve the three actuators 
used for driving one elevator. 
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3. A triple tandem centering valve to move the surface to its neutral position in 
the event of loss of surface control. 

4. A reconfiguration valve consisting of a solenoid actuated shuttle valve that 
determines whether the control valve (DDV) or the centering valve has control 
of the surface. 

Recent advances in solid state current amplifiers and in magnetic materials have made 
the direct drive motor (DDM) a good candidate for the controlling element in a FBW 
system. This FBW actuation system concept is of lighter weight and lower cost than a 
fly-by-wire actuation system composed of multiple surface actuators (similar to Test 
ACT System) controlled by secondary servos. The use of a DDV module in place of 
multiple secondary actuators eliminates the central force-summing shaft of the 
original Test ACT System flight test actuation scheme and permits the assignment of 
one DDV module for each of the two elevators, thus restoring the aerodynamic 
redundancy of the original test airplane. 

4.3.2 TEST ACT SYSTEM MODIFICATIONS 

To interface the Test ACT computers with a direct drive valve (DDV) module requires 
a number of changes to the servo architecture. Some of the changes are demanded by 
the characteristics of the DDV, and some are chosen as a particular approach among a 
number of possibilities. 

The following sections describe the changes to the hardware and reasons for the 
changes. Section 6.2 has additional discussion of the changes with correlation to test 
activities. 
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4.3.2. 1 Essential (ESS) Computer Channel Output Modifications 

One of the primary changes required of the ACCs is the addition of two independent 
current amplifier stages to the output section of each Essential (ESS) computer 
channel. 

The most significant characteristic of the DDV module that demands a major change 
to the hardware is the additional power required to operate the direct drive motor 
(DDM). With the previous actuation system using electrohydraulic servovalves (EHSV) 
as defined in the Test ACT System Description document (ref. 10), each driver is 
required to provide 14 milliamperes (mA) of current. For the DDM, each channel is 
required to source 800 mA of current to provide full authority with only two channels 
operational and 1.25 amperes for chip shearing capability. To supply this increased 
current, a high current operational amplifier was designed into the servo circuit and 
the power supply was modified to power the current amplifier. 

The servo control loop implemented is derived from the suggested servo control loop 
provided by Moog Inc., Aircraft Controls Division, the DDV module manufacturer. 
This approach uses both DDV position feedback and surface actuator position 
feedback. This method is chosen for a number of reasons. First, with DDV position 
feedback, magnetic and frictional hysteresis effects of the DDV unit on system 
performance are essentially eliminated. This reduction means improved surface 
response. Second, DDV position is considered important in failure monitoring, which 
will be discussed in Section 4. 3. 2. 2. Thirdly, with DDV position feedback, when one of 
the four channels is shut off due to a failure, the other channels tend to compensate. 
For equal commands per unit of surface position error, the total current to the DDM 
does not decrease by 25% increments with the loss of each channel as it would with no 
DDV position feedback. Table 2 compares the reduction in total current for the 
implemented control loop. 
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Table 2. Relative DDM current for reduced system channel redundancy with and without DDV 
position feedback. 



Total Motor Current 

Number of 

Percent with 

Percent without 

active channels 

valve position feedback 

valve position feedback 

4 

100 

100 

3 

99 

75 

2 

97 

50 

1* 

91 

25 

• There is no requirement for single channel operation. 



When studying Table 2 it is important to note that the reductions in total motor 
current do not mean full DDV position is not achievable. For the DDM, approximately 
1.6A total motor current (0.4 A in each of 4 coils) is required to obtain full valve 
stroke. The motor manufacturer has given the coils a 1.25A maximum continuous 
current rating. To protect the coils the servo current amplifiers are limited to 1.25A. 
Total current available to the motor with four channels operating is 5.0A. Full valve 
stroke is attainable for all but the single channel operating case. 


The servo loop closure implemented is shown in Figure 13. Gains for the diagram are 
given in Table 3. As shown in the figure, the DDM relative position is a sum of the 
currents of the four individual channels. In this architecture the four currents to the 
motor are individually computed. This means that static offsets of the feedback 
LVDTs, the servo electronics, and of the ESS command will show up as differences in 
the currents to the DDM. During early servo architecture evaluations it was 
recognized that this might cause large (400-600 mA) opposing currents at null 
command. To alleviate this, an equalization circuit is also implemented to minimize 
static currents. This function is also shown in Figure 13. Amplifier currents that 
exceed a threshold of 100 mA are integrated with a 100-second time constant and then 
subtracted from the amplifier command. The equalization is limited so that only 400 
mA of current will be canceled. One concern with this approach is that since the coil 
current is always equalized toward zero, real valve commands are also equalized. The 
time constant is such that there is no noticeable reduction in control capability at 
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Surface Position Surface Position 

Demodulator LVDT 



Figure 1 3. Modified Test ACT System Servo Amp Diagram With Closed Inner Loop 





Table 3. Modified Test ACT Closed Loop Servo Gains (fig. 13) 




control frequencies. This is the classic monitoring problem, where testing of actual 
hardware/software is required to validate that the time constant and threshold have no 
adverse impact on system performance and yet properly trap failures. 

An alternative servo loop closure would include voters. If the ESS command is voted 
before it goes to the servo loop, then each servo would be using identical commands. 
This would alleviate current differences due to the independence of the commands. 
Since there would still be tolerances and offsets in the servo loops, another voter 
would be inserted just prior to the current amplifier. All the currents would then be 
identical, except for minor errors due to the amplifier itself and equalization would 
not be needed. Use of this approach involves extensive crossfeeding of signals 
between channels. For the Test ACT System this was seen as a significant deviation 
from the brick wall architecture. Since the equalization approach seemed viable, it 
was agreed that the brick wall would be maintained up to the DDM. 

4. 3.2.2 Monitoring Changes 

In the Test ACT System actuation scheme, the output monitors depended upon the 
mechanical configuration of the elevator secondary servos and their force summing 
shaft. None of those mechanisms is present in the FBW actuation design concept; 
hence the output monitors must take a wholly different form. 

A major aspect of the modified Test ACT System architecture is that a jammed 
control valve (DDV) must be detected and that servo system shutdown occurs before 
the surface moves far enough to cause an unsafe condition. If one jams, all three 
valves (in the triple tandem configuration) will be stuck and the surface will continue 
to move at a rate dependent on the position of the valve. Since there are two 
independent elevator servos, one for each elevator as described in Section 4.3.1, only 
one surface will continue to move. The functional elevator will tend to counteract the 
failure. However, since this asymmetric elevator activity would put an undesirable 
twist moment on the tail assembly, the counteraction of the other side was not 
considered when determining the reaction time required to shut down the jammed 
servo. 
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Another aspect is surface blowdown, which occurs when the aerodynamic loads on the 
surface exceed the hinge moment capability of the actuators. This is an unusual 
condition, but the system must be tolerant of it and not shut down. With the EHSVs, 
the system used force link position that was proportional to commanded surface 
position. If there was a blowdown situation, the force link, which only drove the PCU 
valves, did not detect it. With the DDV actuation system using actual surface position 
monitoring, the blowdown is detected as an error between surface command and 
surface position. 

The monitoring technique selected for detection of these situations is shown in the 
modified Test ACT servo amp diagram of Figure 13. The servo comparator (C^) 
monitors DDV response by comparing surface position error to DDV position. This 
approach fulfills both of the above criteria (DDV jam and surface blowdown detection). 
If the valve is jammed, the valve position will not track the command. As the surface 
integrates the jam position, the difference between DDV position and surface position 
error will get larger. When the difference exceeds a threshold, the comparator trips 
and a servo disengage sequence is initiated. If a blowdown occurs, the DDV will track 
the surface error even though it has no effect on the surface itself. There will not be 
a difference between the signals and the comparator will not trip. The threshold for 
was selected to be approximately 0.15 mm (37.5%) of valve stroke; that is, if there 
was a difference of 0.15 mm between the valve command and its actual position, the 
comparator would trip. This value was estimated to be low enough to detect all 
failures, yet high enough to preclude nuisance trips. 

The limiter (LI) shown in Figure 13 is seen immediately before the pickoff point for 
the signal. This limiter prevents nuisance monitor trips due to assymetric 
comparator signals. Also, since the surface position error could cause the DDV to 
exceed its mechanical limit of 0.45mm, the limiter is implemented to ensure that 
signals to the comparator limit at approximately the same value. The limiter is set to 
0.4 mm, which is the stroke required for full flow from the DDV. An added feature of 
the limiter is that it prevents the DDV reaching the mechanical stops for large 
command signals. 

The servo comparator detects errors of the DDV and of the surface command; but, it 
does not detect failures of the servo amplifier. To do this, another comparator, called 
the amplifier comparator (C A ), was added, and is also shown in Figure 13. 
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The servo electronics are duplicated, with some simplifications, and then the real 
current to the DDV is compared against the modeled current. If their difference 
exceeds a threshold, an electronic failure has occurred and the servo amplifier is 
disengaged. The threshold is set at 600 mA, approximately 50% of the amplifier's 
current limit. 

It was mentioned in Section 4.3.1 that the airplane would have two DDV modules, one 
for the right elevator and one for the left. The servo loops are also duplicated, one for 
the right DDV module and one for the left. There is no monitoring between the two 
elevator surfaces. The approach is to leave the DDV modules as independent as 
possible, which allows one to continue to function if the other fails. 

The modified Test ACT System engage logic is revised to accommodate both a left and 
right channel to its respective DDV module. If a failure of the surface command that 
affects both surfaces is detected, for example due to a loss of valid pitch rate, both 
servo amplifiers of the failed channel are disabled. However, if a single monitor 
detects a fault of one servo, only the failed DDV module is shut down. When a failure 
is detected, the servo amplifier is disengaged so that it can no longer output current to 
the coil. At the same time, a 28V dc engage enable discrete is removed. To disengage 
the servo, the discrete must be removed by all four ACCs. This allows any subset of 
computers to control the DDV while the failed channels are inhibited from 
contributing errant currents. 

4. 3. 2. 3 Hardware Modifications 

The ACCs were modified to interface with the FBW actuation test system in the 
DAFCL. A brief description of the hardware modifications is given in the following 
paragraphs. It was decided that the changes would be documented in the same fashion 
used for the Boeing 757/767 flight test programs. A "Flight Change" is written that 
describes in detail the physical rework done to the units, the markings to indicate 
status, and the retesting instructions. By using the Flight Change (FC) procedure (see 
Section 5.2 for details), sufficient configuration control and airworthiness are 
maintained. 
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The most significant change to the ACCs was the addition of the current amplifiers. 
Since simple linear amplifiers were used, there was a fair amount of heat to be 
dissipated, and heat sinks were required. The only space available in the chassis to 
mount the amplifiers with heatsinks was on the rear panel. A plate of aluminum was 
designed to mount the amplifiers with a few associated resistors and capacitors. This 
assembly was then wired to the rear connector board and bolted on standoffs to the 
rear panel. 

At least 3A of both plus and minus dc current were required to drive the amplifiers. 
The voltage had to be high enough to overcome back EMF of the motor; + 15V dc was 
not adequate. The existing power supply had adequate +28V dc, but the -28V dc could 
not handle the current. The power supply did have two independent +22V dc circuits 
that became available when the ESS channel engage logic was modified. One of the 
two +22V dc circuits was reversed to make it -22V dc, and rectifying diodes were 
changed to increase both circuits from 1A to 3 A capability. The current amplifiers 
then were powered from + 22V dc. 

The remaining changes of the servo electronics were accomplished on the A6 and the 
A8 circuit cards. Changes to the engage logic were accomplished on the A9 circuit 
card. The Test ACT System Primary and Essential function partitioning onto the 
circuit cards is shown in Figure 14, taken from Reference 10. Each circuit card had 
25% of its area available for growth with hole patterns for component insertion. Some 
portions of the existing circuitry were modified, but in most cases new components 
were added and hand wired. 

Most of the interfaces to the FBW actuation system test fixture used existing signal 
paths. Where new signals were required, new pins were selected on the ACC's rear 
connector and wired to the appropriate cards. 

The modifications to the ACCs were performed by qualified rework operators in the 
Collins Avionics Renton Service Center. Final testing was performed by Service 
Center technicians on the automatic test station. The test procedures and the 
automatic test station interface unit were also modified to accommodate the modified 
Test ACT System. 
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Figure 14. ACC Block Diagram-Partitioning Primary and Essential Functions 



4. 3.2. 4 Changes Resulting from Testing 


During the time the ACCs were undergoing initial hardware modifications, the first 
DDV used in the FBW actuation system underwent testing using a Lear Siegler supplied 
DDM evaluation brassboard electronics unit. The brassboard allowed various 
selectable feedback position loop configurations and was an asset in the laboratory for 
initial data gathering on the DDV. During testing of the first DDV, using the 
brassboard, it was discovered that the DDM gain (mm/A) around zero displacement 
was less than anticipated and approximately 2.4A total DDM current was required to 
obtain full valve stroke compared to the originally specified 1.6 A. The DDV's supplied 
by MOOG for the test were based on similar valves being supplied by MOOG as part of 
the primary flight control actuators for the Swedish SAAB 3AS-39 fighter aircraft. 
However, they incorporated newly designed bellows valve spool seals instead of the 
sliding seals used in the 3AS valves. The first valve was delivered with performance 
deficiencies (reduced motor gain and excessive hysteresis) in order to allow initial 
shakedown testing to begin on schedule. To keep the servo frequency response up, the 
gain of the servo amplifier was doubled from 1.5 to 3.0 as given in Table 3. During 
testing of the servo loops the corner frequency of the F 2 gain (table 3) was increased 
from 3.5 to 10.6 radians to move out the rolloff frequency of the closed servo loops. 
The surface position gain K<-p^ was reduced from 1.4 to 0.7 to eliminate overshoot 
and ringing. All these changes were incorporated in the Flight Change 4 (FC 4), see 
Section 5.2. 

Equalization had been incorporated to reduce static command signal mismatch among 
the channels. It worked well as no channel produced more than about 100 mA to the 
DDM in the static condition. During transients, however, the currents of the channels 
could be significantly different. For large command changes it was not unusual for 
two channels to go to the current limit of 1.25A, one channel to be about 400 mA, and 
the other one to actually be opposite in polarity. Since these were not steady state 
currents the inefficiencies and heating of the DDM was not a big concern. The 
problem was that the resulting average flux in the motor would produce less than full 
stroke. Also it was not symmetrical— the valve would move further one direction than 
another. The surface response was compromised and was clearly unacceptable. The 
large current differences were due to the high gains of the servo loops amplifying the 
tolerance errors of the surface position feedback and of the ESS command. The 
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current differences could have been reduced by using tighter tolerance components 
and fine tuning the circuits, which is an acceptable solution in a laboratory 
environment. However, this was considered a band-aid approach and not acceptable 
for a flight test system. Instead it was decided to delete the DDV position signal (i.e., 
inner loop feedback). 

The open inner loop servo diagram is shown in Figure 15 with the gains given in Table 
4. Flight Change 6 (FC 6) was written to implement these changes and additional 
testing was performed. For this configuration the DDV position command limiter had 
to be removed from the command path allowing the current to go to the full 1.25A for 
large ESS commands. This gives a total of 2.5A in the two channel condition, which 
provides full valve stroke. With the gains selected, the two channel frequency 
response meets the performance requirements. The limiter (LI) was maintained in the 
comparator signal path to prevent assymetric comparator signals resulting in nuisance 
trips. 

Valve position was retained for the servo comparator C,.. Now, however, since the 
valve position varies by 25% per channel for each unit of surface error (see table 2), 
the threshold has to open wide enough to preclude nuisance trips for the k, 3, and 2 
channel conditions, yet still detect the jammed valve. The threshold was set to 0.3 
mm (75% of valve stroke). Although testing of the failure detection system showed 
that this approach works, it needs thorough analysis before being used in a production 
type system. 

The amplifier comparator (C^) approach remained basically unchanged except that 
due to hardware constraints the equalization circuitry was not duplicated and modeled. 
This would require analysis to see how much modeling is necessary to detect all 
pertinent servo electronics faults. 

4.3.2.5 Test ACT Console (TAC) Changes 

To interface the modified ACCs to the lab required changes to the Test ACT console. 
This amounted to minor wiring additions to the junction box for the new signal paths. 
These changes were accomplished by Boeing technicians. The changes were 
documented in FC 5. 


43 



Surface Position Surface Position 

Demodulator LVDT 



44 


Figure 15. Modified Test ACT System Servo Amp Diagram With Open Inner Loop 



Table 4. Modified Test ACT System— Open Inner Loop Servo Gains (fig 15) 


Identifier 


^ SS CMD 

= 0.125 V/deg 

Fi 

= Deleted 

f 2 

- °' 8 v/v 

134 +1 

f 3 

= q~ VA/ 

910 

S a 

= 3.0 AN 

l 4 

= ± 1.25A 

K m 

= 0.165 mm/A (0.0066 in./A) 

K v 

= 6.7 X 10" 4 m 3 /sec/mm 

K S a 

- 2.3 X 10 5 deg/m 3 

Ksp 

= 0.18V ac/deg 

Kspd 

= 0.71 V/Vac 

K VP 

= 0.616V ac/mm (15.4V ac/in.) 

Kvpd 

= 1 3.0 V/V ac 

Kmvp 

= 18.0 VA/ 

Li 

= ± 3.23V (+ 0.4 mm) 

K a 

= 1.0 V/A 

•th 

= ± 0.1V(± 0.1 A) 

K E q 

= 0.0023 VA/ 

l 2 

= ± 0.083V (± 0.2A) 

Kmc 

= 3.0 V/V 

l 3 

= ± 1.25V(± 1.25A) 

Cs"Tih 

= ± 2.42V (± 0.3 mm) 

C a T h 

= ± 0.6V (± 0.6A) 
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4.3.3 DIRECT DRIVE VALVE ACTUATION SYSTEM TEST FIXTURE 


A laboratory test fixture was fabricated to allow testing of the DDV in a simulated 
elevator actuation system. Figure 9 is a photograph of the actual fixture as tested in 
the Renton Flight Control Systems Hydromechanical Laboratory (RFCSHL). The 
frame for the fixture was fabricated from structural steel and supports the following 
hardware: 

o The DDV module, Moog P/N 50E511-1 or -2 
o A balanced area surface actuator 
o A simulated elevator surface driven by the actuator 
o Four LVDTs to provide surface position feedback 

o A centering valve to provide testing of the DDV reconfiguration valve concept 
o A summing arm to provide input to the centering valve 

Hydraulic power was provided by a 21,000 KPa (3000 psi) pumping system utilizing 
phosphate ester based (BMS 3-11) fluid. Elevator surface inertia or airloads were not 
simulated. 

Figure 16 is a schematic of the DDV module used in the laboratory testing. The DDV 
module consists of the following equipment: 

o A linear force motor with four coil control input (DDM) 
o A single spool type control valve (DDV) 
o Four valve position sensing LVDTs 
o Two bypass valves 

o An external adapter to permit valve jam and chip shearing tests 

This DDV module contains a single control valve, not a multiple tandem valve as would 
be used in a flight system. Testing was therefore performed with a single hydraulic 
system. The two bypass valves simulate the reconfiguration valve of a flight system. 
These valves were included to allow testing of the system shutdown characteristics for 
surface centering. 
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Control Valve (DDV) 




Figure 16 . 









5.0 LABORATORY TEST PLAN 


Extensive laboratory testing and limited flight testing of the Test ACT System were 
originally planned. The primary objective of the Test ACT System laboratory tests 
was to verify and validate the system hardware and software. The first phase was 
avionics hardware and software acceptance tests performed at Collins Air Transport in 
Cedar Rapids, Iowa, to verify that the system, as designed and built, met the 
requirements. The majority of laboratory testing was performed in the Boeing Digital 
Avionics Flight Controls Laboratory (DAFCL) following delivery of the system. The 
testing at Boeing was to validate the requirements and prove that the system was safe 
for flight. The approach was to assign the tests to categories (see Section 5.3) that 
progressed from simple open loop hardware tests to closed loop hardware tests to 
closed loop performance and failure response tests, with and without pilot, on an 
airplane simulation. 


The flight test plans were subsequently cancelled and the activities covered by the 
original Laboratory Test Plan were reduced in scope to include only open loop tests of 
system hardware and software, and limited tests of an alternate FBW actuation system 
(a DDV system) commanded from the modified Test ACT System. 

5.1 LABORATORY FACILITY DESCRIPTION 


5.1.1 DIGITAL AVIONICS FLIGHT CONTROLS LABORATORY 


All Boeing tests were conducted at the Digital Avionics Flight Controls Laboratory 
(DAFCL). This laboratory is located adjacent to the Renton Flight Simulation Center 
(RFSC). The primary function of the DAFCL was 757/767 flight control system 
validation, although support is also provided to advanced technology programs such as 
Test ACT, and to software development. The laboratory layout is shown in Figure 17. 

The DAFCL contains work areas with digital simulation hardware, test consoles, 
analog computers, interface equipment, and other support hardware. The ability is 
provided to conduct real-time simulations with simulated control inputs. The complex 
can be interconnected with the RFSC for testing with crew cabs and high fidelity 
aerodynamic models. 
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Figure 17. DAFCL Laboratory Layout 








5.1.2 DIGITAL AVIONICS FLIGHT CONTROLS LABORATORY SIMULATIONS 


The DAFCL Data General Eclipse S250 computers host simulations of the airplane 
equations of motion, sensors, servos, airplane environment, and engine dynamics. The 
sensor and servo simulation include proper timing, scaling, and significant 
nonlinearities. 

The Eclipse aerodynamic model is derived from the high fidelity aerodynamic models 
used in the RFSC. This process provides good configuration control of airplane data. 
The Eclipse computers were used to (1) provide an automated test sequence, (2) record 
test resuits, (3) simulate sensors and actuators, and (4) provide input and output 
simulation and failure models. 

5.1.3 RENTON FLIGHT CONTROL SYSTEMS HYDROMECHANICAL LABORATORY 

The Renton Flight Control Systems Hydromechanical Laboratory (RFCSHL), located 
adjacent to the DAFCL (fig. 17), is used for development, verification, and validation 
testing of aircraft hydromechanical equipment. The laboratory contains complete 
electrical and hydraulic fluid distribution systems with convenient connect points. 

A special test fixture was built in the RFCSHL to test a direct drive motor and valve 
in a four-channel closed-loop configuration. This test fixture is described in Section 
4.3.3. The direct drive motor was controlled, through the work station interface (WSI), 
by the active controls computers (ACCs) located in the adjacent DAFCL. 

5.1.4 DIGITAL AVIONICS FLIGHT CONTROLS LABORATORY TEST SUPPORT 
EQUIPMENT 

In addition to the simulation host computers, the other equipment required for DAFCL 
testing is shown in Figure 18. The major elements are described as follows: 

o A front-end processor (Data General Eclipse S230) is provided with each 
simulation host. It has the capability to format the floating-point simulation data 
to or from the equivalent fixed-point format that is compatible with the line 
replaceable unit (LRU) interface equipment. 
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Standard Analog/Digital Cables to LRU Test Pallet 
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Figure 1 8. Typical DAFCL Test Configuration 



o A WSI is provided for interfacing the Primary and Essential computers and the 
Test ACT console (TAC) with the rest of the laboratory. This device controls the 
buffering, conversion, signal conditioning, and other required LRU interfacing. A 
patch panel is provided for flexible interconnection to the TAC. 

o A simulation control console is provided for the test conductor interface. This 
console includes a simulation control CRT and a panel of programmable controls 
and displays (discrete switches, lamps, rotary input encoders, and numerical 
displays). 

Figure 19 illustrates the interfacing required for the Test ACT work station. 

5.1.5 DIGITAL AVIONICS FLIGHT CONTROLS LABORATORY SUPPORT SOFTWARE 

The DAFCL support software includes a real-time simulation and test executive, 
plotting routines, test driver software (e.g., frequency response test), interface 
software and data bases, diagnostic software, and analysis programs. The real-time 
simulation and test executive is a higher order language within which simulation 
models and open-loop test drivers are combined to form a simulation package. It also 
provides a standard user interface for simulation initialization, control, and data 
acquisition. 

Supporting aids, such as LRU and Aeronautical Radio Incorporated (ARINC) data 
bases, high-fidelity LRU models, comparison checkers, problem tracking, and report 
generation capabilities, are also provided. 
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5.2 CONFIGURATION MANAGEMENT 


The laboratory test plan for this system assumed that it would ultimately be flown in 
flight test; therefore, it was necessary to maintain configuration control so that 
airworthiness of the equipment was preserved. The Test ACT System configuration 
control procedure was designed to provide adequate documentation of changes to 
enable Quality Assurance to ascertain that flight worthiness of the equipment had 
been retained. The procedure used is called the Red Label procedure after the 
markable red identification label applied to each item of equipment. 

The normal sequence of operations required for changing the equipment under Red 
Label configuration control is listed as follows: 

1. The test results lead to the writing of a problem report and a resulting proposed 
equipment change. 

2. The problem report and change proposal is reviewed and approved by the Materiel 
Review Board. 

3. When such approval is given the change becomes part of a Flight Change Record 
Sheet (FC). 

4. When the FC has been reviewed and approved, the equipment is modified in 
compliance with it. 

5. The modifying agency inspects the changed equipment and signs the FC copy 
accompanying it. 

6. Boeing Quality Assurance inspects the modified equipment, approves the FC, and 
marks the Red Label accordingly. 

7. The FCs for each LRU are maintained in a log under the equipment name and 
serial number. 
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The Test ACT System has had six FCs written. They are: 


FC No. Subject 


1 Improve Servo "Fail" Annunciation 

2 EMI Susceptability Improvement 

3 Revise Column Force Common Mode Monitor Threshold 

4 ACC Modifications To Drive DDVs 

5 Test ACT Console 3unction Box Changes for DDV Integration 

6 ACC Modifications Due to Actuation Integration Test Results 


Flight Change numbers 1 through 3 were written to document the required changes, 
but were not implemented since they would not hamper laboratory testing. They 
would be installed prior to flight test. Flight Changes 4 through 6 have been installed 
and a successful functional test performed on all 5 ACCs. 


5.3 LABORATORY TEST DEVELOPMENT AND SCHEDULE 


The development of the laboratory tests procedures paralleled the two-part nature of 
the test program. The first part was concerned with validating a flightworthy system. 
The development of procedures to certify a system flightworthy is described in Section 

5.3.1. 


The objective of the second part of the test program was to investigate an alternate 
FBW actuation system for the Test ACT System. This actuation system would 
complement the fly-by-wire nature of Test ACT. The development of the procedures 
for the second part is described in Section 5.3.2. 

5.3.1 TEST ACT SYSTEM 


The requirement on this phase of testing was to develop a set of tests that would 
validate every requirement. These tests should be written so that they could be 
repeated exactly at a later date. The process used to fulfill these requirements is 
explained and illustrated in the following paragraphs. 
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5.3. 1.1 TEST DESIGN AND DEVELOPMENT 


Review and analysis of system requirements documentation and the supplier's design 
and verification documentation were used to develop a test matrix. This matrix was 
used in turn to design the test cases (plans of test) for which procedures were 
developed. The test cases were chosen in a manner that covered the requirements in a 
balanced fashion, with a minimum of duplication of previous verification 
testing. Plans of test, as well as detailed test procedures (DTP), were developed prior 
to the beginning of trial test runs and were finalized prior to the formal test runs. 

5.3. 1.2 Laboratory Test Categories 

The design of the test cases and the overaii planning of the testing was aided by 
initially dividing the requirements to be tested into logical categories. These 
categories provided the first-level organization for the development of the test cases 
(plans of test). 

A list of categories that met the needs of the Test ACT System laboratory test effort 
follows: 

o Open-loop hardware tests 

o Open-loop software tests 

o Failure detection tests 

o System integration tests 

o Closed-loop system performance tests 

o Closed-loop failure response tests 

Table 5 illustrates the test categories and their contents, as envisioned for the Test 
ACT System laboratory tests. 

5.3. 1.3 Development of Test Procedures 

The general test philosophy was to first verify that the system meets all requirements 
given in the Specification Control Drawing (SCD) and that the result is a safe system 
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Table 5. Laboratory Test Plan Categories— Test ACT System 


OPEN-LOOP HARDWARE TESTS 

• EMI, power transient, and quality susceptibility 

• Control panel operation 

• Input/output interface 

• Primary system hardware monitors 

• Essential control laws 

• Essential PAS/FBW monitors 

• Primary system output voting 

OPEN-LOOP SOFTWARE TESTS 

• Flight deck interface 

• Pitch control laws 

• Wing-load alleviation 

• Signal selection and fault detection 

• Output management 

• Program control 

• Fault reporting and recording 

FAILURE DETECTION TESTS 

• Power-up 

• Preflight 

• Periodic tests/monitors 

• 

SYSTEM INTEGRATION TESTS 

• Test ACT ID ADC i nteg ration 

• Test ACT /I RS i nteg ration 

• Test ACT/CSEU/FSEU integration 

• Test ACT /secondary actuator integration 

CLOSED-LOOP PERFORMANCE TESTS 

• Closed-loop stability and response (unpiloted) 

• Closed-loop stability and response (piloted) 

CLOSED-LOOP FAILURE RESPONSE TESTS 

• Airplane response to failures (unpiloted) 
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that meets the performance requirements. Each requirement to be tested by Boeing 
was covered by at least one detailed test procedure (DTP). Each of them verifies 
several requirements. 

The DTP was developed in three steps. Step one, as explained previously, was to 
identify the requirements to be verified. Step two was to write a short description of 
a test that would verify those requirements. Step three, which was performed in the 
laboratory, was to determine the procedures required to perform a repeatable test. A 
primary requirement for DTPs was that they contain enough information to repeat the 
procedure years later. It was in this third step that the computer programs used to 
automate the test were developed for the Eclipse. 

5.3. 1.4 Example of Requirement Verification and Traceability 

Figures 20 through 24 illustrate the process of test design and development by tracing 
the verification of a typical requirement from its assignment in the requirements 
matrix to the actual verification of the requirement by test data. The requirement 
picked for this example is from Section 3.3.3. 1, "Essential Control Law Requirements," 
of D6-51146 Volume I, "Test ACT System Specification Control Drawing, Volume I." 
As can be seen in Figure 20, this requirement is to be verified by test in DTP T.l.1.5. 

The specific requirement to be verified is shown in Figure 21. This figure is an 
example of Part 1 of DTP T.l.1.5. The Part 1 of each DTP contains the specific 
requirements to be tested by that DTP. Requirements from different sources are 
often consolidated into a minimum set of testable requirements. In this example the 
requirement to be verified deals with gains and gain changes in the essential control 
laws. 

Figure 22 illustrates the next step in the test development, a description of a test that 
will verify the corresponding requirements from Part 1. These test specifications 
make up Part 2 of the DTPs. For our example, paragraph b of the test specification 
describes a test that will verify our example requirement. 

The next step is to develop a step-by-step procedure to run the test described in Part 2 
and to obtain and evaluate the results. These procedures form Part 3 of the DTP. The 
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DOC. 

REF: 

D6-51 146 Volume 1 Specification Control Drawing 



Para 

Paragraph Title 

Method 

DTP 

Number 


of Verif 

Number 

3.3. 2. 5. 4 

Autopilot/Test ACT Switching 

T 

T.1.1.2 

3.3.2. 6 

Electrical Power 

1 

- 

3. 3. 2.7 

Hydraulic Power 

1 

- 

3.3.3 

Control Law Reauirements 

N/A 

- 

3.3.3. 1 

Essential Control Law Requirements 

T 

T.1.1.5 

3.3. 3. 2 

Trim Operations and Management 

T 

T. 1.2.2 

3.3.4 

System Performance Monitoring 

N/A 

- 

3.3.4. 1 

Monitoring of Essential PAS/FBW 

T 

T.1.1.6 

3.3.4.2 

Monitoring of Primary PAS & WLA 

N/A 

- 

3. 3. 4.2.1 

WLA Monitoring 

T 

T.1.2.3 

3.3.4.2.2 

Primary PAS/FBW Sensor and Command 
Monitoring 

T 

T.1.1.4 

3.3.4.2.3 

Primary Processor Monitoring 

T 

T. 1.1.4,11. 2.6 

3. 3. 4.2.4 

Primary Power Supply Monitoring 

T 

T.1.1.4 

3.3.5 

Engage/Disengage Function 

N/A 

- 

3.3.5. 1 

Essential PAS/FBW Requirements 

T 

T.1.1.5, T.1.1.6 

3. 3. 5.2 

Essential Servo Engage Logic 
Implementation 

l&T 

T.1.1.5, T.1.1.6 

3. 3. 5. 3 

WLA Engage/Disengage Requirements 

T 

T.1.1.4, T.1.2.3 

3.3.5.4 

WLA Servo Engage Logic Implementation 

1 

- 

3.3.5.4.1 

WLA Active Logic 

T 

T.1.1.4 

3. 3. 5.4. 2 

WLA Drive Valve Switching 

T 

T.1.2.3 

3.3. 5.4. 3 

WLA Engage Circuitry Monitoring 

l&T 

T.1.1.4 

3.3.6 

Redundancy Management 

N/A 

- 

3.3.6.1 

Primary Sensor Input Voting Requirements 

T 

T.1.2.4 

3.3. 6.2 

Primary Elevator Command Voter 
Requirements 

T 

T.1.1.7, T.1.2.4 

3.3. 6. 3 

Primary Elevator Command Voter 
Implementation 

T 

T.1.1.4, T.l. 3.1, T.1.1.2 

3. 3. 6.4 

Cross-channel Data Requirements 

T 

T.1 .2.4, T.1 .2.5, T.1 .3.3 

3.3. 6.5 

Primary Processor Synchronization 

T 

T.l. 1.3, T.l. 2.6 

3.3.7 

v f 

Annunciation Implementation Requirements 

N/A 

! 



Figure 20. Example of Requirements/Test Matrix 
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Part 1 — Test Requirements Page 1 - of 1 


Aircraft: System: Te$tAct Number: DJpTl A g Revision: 


Title ' Essential Control Laws 


Req# 


Test Requirement 

Requirement Reference 

Control Laws 


The Essential control law is defined in Figure 3.2.1 .1 .-1 . 

3. 2. 1.1, SCD Vol. 1 
3.3.3.1.SCD Vol. 1 

Initialization of filtering and gain-changing function shall not be 
required. The Essential PAS shall include the capability to 
modify selected gains and the Primary PAS authority limit as a 
function of flap position. The flaps-down condition shall be 
detected when at least three of four FSEU discretes indicate the 
fiaps-down condition. Gain and iimii parameters shaii be 
changed from flaps-down to flaps-up values and vice-versa at a 
nominally constant rate. The commanded gains and authority 
limit shall be set to the “flaps-up" values, provided at least two 
of the four FSEU discretes indicate “Flaps 0.” 

3.4.1. 5.1 SCD Vol. 1 
3.3, D6-49364 

The gain and limit values during the switching transition shall 
satisfy the following criteria: 


a. The time required to switch between parameter extremes 
shall be 5.0 ±1.0 sec. While it is being switched, an 
affected gain of one channel shall not differ from that of 
another by more than 10% of the range through which the 
gain can be changed. 


b. The rate-of-change of the switched parameter shall not 
change sign during the transition. 


c. 50% of the desired change shall occur over a 2.5 ±1 sec 
interval. 


The Essential PAS/FBW shall provide the functions and output 
depicted in figure 3. 3. 3. 1-1. Each function shall supply 
nominal performance over an output range of -1 0 VDC to + 1 0 
VDC, except to the extent that the range is restricted by the 
function definition. The elevator command output of each 
Essential PAS/FBW channel shall be distributed to all of the 
four Primary computers. 

3.3.3. 1, SCD Vol. 1 


Figure 2 1 . Example of Detailed Test Procedure — Part 1 















Aircraft: 


Part 2 — Test Specification Page 2- of 2- 


Sys,em: Test Act Number: T.1.1.5 Revlsi0n: 


Essential Control Laws 


Use the following test setup: 


Test Specification 


1 . TAC complete, operationally powered and interfaced to WSI. 

2. O.P. loaded 

3. Eclipse driver programs as specifically required. 

4. The following equipment to be available: 

a. Stripchart recorder 

b. H/P 5420 signal analyzer 

c. EMR 1 1 70 frequency analyzer 

d. Magnetic tape storage 

e. X-Y plotter 

Using the Eclipse, initially set all flap discretes to the up position and Primary 
PAS and WLA off. Vary the sequence in setting the discretes to flaps down. 
The flap position, and thus the control law gains scheduled against flaps, 
shall transition to flaps down when any three discretes so indicate. 


With the Primary PAS off, flaps up and Eclipse test drivers, input a ramp 
command at the column and record the output of all channel servo 
commands on the strip chart recorder and/or X-Y plotter. Transition to flaps 
down. Verify that all gain change and accuracy requirements are met. 


Repeat “b” with a similar input at the rate gyro interface. 

Engage the Primary PAS. Input a column step of sufficient magnitude to 
saturate the feedback authority of the Primary. Verify that the Primary 
authority limit is 7 deg for flaps down and 2.5 deg for flaps up. 

Set the Primary PAS to “off.” Verify the frequency response requirements of 
tables 3.4.1. 5.2-1 and -2. Use either an Eclipse driver program, the H/P 5420 
or the EMR1 1 70 to input a sinusoidal sweep command at the column force 
interface of ± 1 volt at 20 increments/decade from 0.10 to 10 Hertz. Check 
all channels. 

Perform similar sweeps for the pitch rate feedback paths. Input a ± 1 volt 
sinusoid at the rate gyro interface. 
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Figure 23. Example of Detailed Test Procedure — Part 3 









5.3.2 MODIFIED TEST ACT SYSTEM 


This phase of testing began while the design was still in progress. The direct drive 
valve (DDV) and direct drive motor (DDM) characteristics were not completely known 
and it was necessary to determine these first. Furthermore, the design was performed 
in several iterations, and tests were required for each iteration. 

Preliminary DTPs were written at this time. These DTPs would be used at the end of 
the design effort to determine how sucessful the design effort had been in meeting the 
requirements set forth. The following paragraphs describe the development of these 
procedures. 

5.3.2. 1 Design Development Test 

The first step in the development tests was to verify the specifications provided by the 
vendor. The next step was to determine if there were any performance characteristics 
not mentioned by the vendor that would have a major effect on the design. By 
necessity these tests were exploratory in nature and detailed test procedures were not 
prepared. Section 6.2 describes these tests and their results. 

5.3.2.2 Design Validation Test 

Three Detailed Test Procedures were writen to validate the final actuation design. 
These tests are: 

DTP DDM-1 Interface Test 
DTP DDM-2 Performance Test 
DTP DDM-3 Fault Detection Test 

These tests were developed in a manner similiar to the DTPs described in Section 5.3.1 
but to a lesser degree of detail. 
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applicable Part 3 for the example is shown in Figure 23 and the resulting data is shown 
in Figure 24. This data shows that the requirements are met for column force inputs. 
Subsequent steps verify the gain and gain change requirements for other inputs. 

5.3.3 TEST SCHEDULE 

Figure 25 gives the schedule for laboratory testing. Laboratory development and test 
planning occurred concurrently. Both began on duly 6, 1983 when the Test ACT 
hardware and software arrived from Collins Air Transport. After a short installation 
and checkout period, testing commenced. Testing on the baseline Test ACT System 
was halted in February 1984 after completion of the first two test categories (i.e., 
open loop hardware and open loop software tests). The remainder of the testing 
concentrated on integrating the Test ACT System with an FBW actuation concept 
using a Direct Drive Valve (DDV). The initial testing of the first DDV module supplied 
by Moog was interfaced with a DDM Evaluation Brassboard provided by Lear Siegler. 
The ACCs were modified to the FC 4 (see sect 5.2) configuration and interfaced with a 
second DDV supplied by Moog. Test data evaluation resulted in further modifications 
to the ACCs, which was accomplished under FC 6 control. 
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Figure 25. Test ACT System Laboratory Test Schedule 




















6.0 LABORATORY TEST RESULTS 


The following major sections, 6.1 and 6.2, are the results of the testing performed at 
the DAFCL with the Test ACT System and the modified Test ACT System. 

6.1 TEST ACT SYSTEM 

During the laboratory testing of the Test ACT System, all the hardware tests and the 
major open loop software tests were performed. All major functions worked well. 
There were 33 problem reports generated. Two problems were considered major. 
They deal with the power supply and are discussed in Section 6.1.4. The following 
sections discuss the tests performed and the problems uncovered. 

6.1.1 OPEN LOOP HARDWARE TESTS 

6. 1.1.1 EMI Susceptibility, Power Quality 

This test was conducted to verify that the Test ACT System met all requirements on 
susceptibility to EMI, including lightning, and on tolerance to low and high voltage 
power transients. The tests that involved EMI, lightning, and power transients were 
conducted by the Boeing EMI staff. 

The Test ACT System met all EMI and power quality requirements but one. It failed 
the radio frequency (RF) susceptibility test in the 7-9 MHz range. The failure was 
evidenced by an indication of invalid primary elevator commands with subsequent loss 
of Primary PAS Valid. Subsequent investigation discovered that the Primary 
Command D/A circuity was not protected from externally generated RF radiation and 
was sensitive to RF feedback. 

An RF filter is needed for the production system and was documented in FC 2. No 
change was proposed for the Test ACT System because its location during flight test 
would provide adequate shielding from RF radiation in the frequency band of interest. 
The system also met all power transient requirements except one. An interruption of 
both power sources to an ACC of less than 50 milliseconds resulted in a 
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dropout of the essential servo shutoff valve for the duration of the power interruption. 
This was considered acceptable for the Test ACT System but would have to be 
corrected for the production system. No EMI susceptibility or power quality tests 
were made on the modified Test ACT System. 

6. 1.1. 2 Control Panel Operation 

This test was conducted to verify the interface between the Test ACT System and the 
control panels (TACP, FTP, and PFTP). All combinations of signals to and from the 
control panels were generated and the proper displays on the relevant panel were 
verified. A complete manual checkout of the control panel signals, switches, and 
lamps was performed. 

Several minor problems were uncovered and corrected during the performance of this 
test. The only major problem uncovered was a failure of the Test ACT control panel 
to display a fail message following a power supply failure. A solution was developed 
and documented in FC 1, but not implemented since this problem would not have 
affected flight test. 

6.1. 1.3 Input/Output Interfaces 

This test was conducted to verify the interfaces between the Test ACT System and 
airplane sensors including: Flap-Slat Electronics Unit, Air/Ground Logic Unit, pilot and 
copilot column, hydraulic power, elevator surface positions, Control System Electron- 
ics Unit (CSEU) valid and arm discretes, Autopilot Flight Director System (AFDS) 
disable, stabilizer position, Inertial Reference System (IRS), Digital Air Data 
Computer (DADC), servo, and program pins. Also, as part of the DTP, the Essential 
servo equalization function was verified. 

All interfaces proved to function correctly. The servo equalization function, however, 
did not. Whenever the equalization function exceeded its threshold it introduced a 
small limit cycle with a frequency of approximately 27 Hz. This oscillation 
disappeared when the gain in the equalization loop was reduced. Efforts to remedy 
this problem were discontinued when the decision to change to a different actuation 
scheme was made. 
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6. 1.1. 4 Primary System Hardware Monitors 


This test was conducted to verify the ability of the Test ACT System to detect 
column-force transducer faults, processor and computation related faults, power 
faults, WLA engage/disengage logic faults, and PAS warning function faults. 

The system detected all faults without problems except for the loss of 26V ac 
excitation to the column force transducers, which for some cases was not detected. 
Investigation revealed that the fault detection design, which had been borrowed from 
an autopilot design, had been slightly modified and was now marginal in performance. 
A revision to the circuit was designed and tested sat if actor ily. It was documented in 
FC 3. 

6. 1.1. 5 Essential Control Laws 

These tests were conducted to verify essential control law end-to-end frequency 
response, control law gains, compensation implementation, and Essential servo 
engage/disengage functions. These tests used Eclipse test drivers to simulate the 
flight conditions required. 

All functions tested by this procedure were within specifications. 

6.1. 1.6 Essential PAS/FBW Monitors 

This test was conducted to verify the ability of the Test ACT System to detect and 
respond to the following types of faults: servo detent collapse and other actuator 
faults, power supply faults, and passive sensor faults. 

The system responded satisfactorily in all cases. 

6. 1.1. 7 Primary System Output Voting 

This test was conducted to verify that the elevator command outputs from the four 
primary computers are properly selected by each essential computer for any combina- 
tion of primary failures. The system met all requirements. 
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6.1.2 OPEN LOOP SOFTWARE TESTS 


Because of the shortened test period, only the major software tests were run. In 
general the software was well designed and implemented and only minor problems 
were uncovered. These problems as well as some example results are discussed in this 
section. 


6. 1.2.1 Pitch Control Laws 

These tests were conducted to verify the pitch primary control law end-to-end 
frequency response, verification of control law gains, compensation implementation, 
and flight test change provisions. These tests used Eclipse test drivers to simulate the 
flight conditions required and did not include any effects of airplane aerodynamics. 

These tests verified that the primary controls laws were implemented as required. 
The combined effect of the Primary and Essential control laws is shown in Figure 26. 

6. 1.2.2 Wing Load Alleviation (WLA) 

These tests were conducted to verify the wing load alleviation control laws including 
power-up, ACC selection, servo solenoid activation, end-to-end frequency response, 
control law gains, and compensation implementation. These tests used Eclipse test 
drivers to simulate the flight conditions required. 

The wing load alleviation control laws were verified to be implemented as per the 
requirements. The frequency response of the aileron to normal acceleration at the 
wing is shown in Figure 27. 

6. 1.2.3 Signal Selection/Fault Detection (SSFD) 

These tests were conducted to verify the sensor management SSFD functions of signal 
selection, sensor selection, and fault detection, SSFD initialization and discrete 
management. The ability of the Test ACT System to detect failures in inputs to the 
ACC computers was likewise verified. The ability to make the transition from ground 
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Figure 26. Pitch Control Law Frequency Response Test Results 









to flight and back to the ground was verified. These tests were performed open loop 
using Eclipse computer test drivers to simulate the flight and failure conditions 
required. 

As illustrated in Figure 28, the signal selection fault detection algorithm worked well 
when presented with clear failures. These tests did, however, uncover some instances 
where the failure limits had been incorrectly set. In other cases, the scaling of the 
input variables was such that the limits were represented by one or two machine bits. 
Whether this scaling would have resulted in excessive nuisance faults would have been 
determined during the closed loop failure response tests. 

6. 1.2.4 Output Management 

These tests were conducted to verify that the Test ACT System correctly determines 
the PAS/FBW control law engagement and disengagement sequences and correctly 
selects which ACCs have active control over the WLA and stabilizer outputs. This 
test was performed open loop using the Eclipse computer. 

The requirements were met without problems. 

6.1.3 OTHER TESTS 

The following test procedures were prepared but because of the program changes were 
never executed: 

1. OPEN LOOP SOFTWARE 

Flight Deck Interface 

Program Control 

Fault Reporting and Recording 

2. FAILURE DETECTION 

Power-up Tests 
Preflight Tests 
Periodic Tests/Monitors 
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3. SYSTEM INTEGRATION 

Test ACT/DADC Integration 

Test ACT/IRS Integration 

Test ACT/CSEU/FSEU Integration 

4. CLOSED LOOP PERFORMANCE 

Closed Loop Stability and Response (Unpiloted) 
Closed Loop Stability and Response (Piloted) 

5. CLOSED LOOP FAILURE RESPONSE 
Airplane Response to Failures (Unpiloted) 
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6.1.4 DISPOSITION OF PROBLEM REPORTS 


Table 6 is a list of the problem reports written during the avionics test phase. Of the 
33 reports, 9 were significant, that is, they must be fixed before flight test, 20 were 
insignificant (e.g. the system was correct but the documentation was incorrect), and 4 
were later determined to be a fault of the test setup. The problems were equally 
divided between hardware and software. 

Two of the problems required design changes. These are PR No. 3, "Power Supply 
Monitor Failure during Preflight Tests," and PR No. 4, "Failed Power Supply in Acc 
S/N EE003." The first problem was a result of a close tolerance executive monitor of 
the power supply. This monitor is "executive" in the sense that when it trips the ACC 
is shutdown. Close tolerance executive monitors are anathematic to the Test ACT 
architecture. They lead to a large number of nuisance faults and could result in 
complete loss of function, that is, a hardware generic fault. A change to the power 
supply monitor was designed and was incorporated into the ACCs in FC 4. 

The second problem, a failed power supply, was the result of shorting the 26V ac LVDT 
drive voltage. When the short was removed, the resulting transient destroyed 
transistors in the power supply. Since the supply was designed to survive shorts of the 
26V ac output, extensive testing and analysis of the circuitry was conducted by Collins 
at their Cedar Rapids facility. It was determined that application or removal of a 
short caused a large thermal transient on switching transistors adjusting to the new 
load, and this transient on top of the normal thermal ambient was higher than the 
thermal rating of the transistors. Since a major redesign of the supply would be 
required to fix the problem, and since the problem was not a safety issue (a shorted 
LVDT excitation disengages the channel regardless of power supply survival), the 
results of the study were documented, but no design change was initiated. A 
production version of such a system would be redesigned to protect against this 
problem. 
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Table 6. Problem Report Disposition 


PR NO. 

TITLE 

RESOLUTION 

1 

Stabilizer Scaling 

Closed 

2 

Essential PAS Failure at Maximum Column Input 

Closed 

3 

Power Supply Monitor Failure During Preflight Tests 

Note 1 

4 

Failed Power Supply in ACC S/N EE003 

Closed 

5 

Program Memory Loss With Power Off S/N EE002 

Closed 

6 

H/W Failure Breakout No. 4 

Closed 

7 

Essential Rate Gyro Demodulator Scaling 

Closed 

8 

TAC Display of Monitor Status 

Closed 

9 

No Fail Message on TACP When Power Is OFF 

Closed 

10 

Hardware Failure Breakout No. 2 

Closed 

11 

No-Go Reset 

Closed 

12 

Short Preflight Lamp Test 

Closed 

13 

Passive Preflight Switch No Held In 

Closed by PR17 

14 

Failure of Column Force CMM to Detect Loss of 26 VAC 

Note 2 

15 

Preflight Test Failure With Flaps Down 

Note 3 

16 

TAC Processor Flight History Event Timer Fast 

Closed 

17 

Passive PFT Fails to Abort Test in Process 

Closed 

18 

Incorrect Output of Essential Voter 

Closed 

19 

ACC Susceptibility to Radio Frequency Radiation 

Note 2 

20 

Dropout of Essential Servo SOVs With Power Interruption 

Closed 

21 

Failed Power Supply in ACC S/N 002 

Closed 

22 

Phase Discrepancy in Essential Control Law 

Closed 

23 

Essential PAS Servo Equalization Limit 

Closed 

24 

Limit Cycle in Servo Feedback Loop 

Note 3 

25 

Pitch Rate Offset in ACC S/N EE005 

Closed 

26 

Primary Processor Halt in Error Routine Loop 

Closed 

27 

Unstable 400 Hz Amplitude Regulation 

Note 1 

28 

Primary Control Law “Stab Gain Scheduled Feedforward Filter” 

Note 2 

29 

Primary Control Law “Addition of Pitch Rate Feedback” 

Note 2 

30 

Primary Control Law “Stabilizer Offload Thresholds” 

Note 2 

31 

Elevator Transient With Dead Trim Fault 

Note 2 

32 

SSFD Limits on NZB (Body Acceleration) 

Note 2 

33 

Equalization Rate Limits 

Note 2 

Note 1 

Design and implement fix 


Note 2 

Design but do not implement 


Note 3 

No further work required 
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6.2 MODIFIED TEST ACT SYSTEM 


This section summarizes the testing and presents the test results of a direct drive 
valve (DDV) controlled surface actuation system consisting of the modified Test ACT 
System as described in Section 4.3.2 and the FBW actuation system as described in 
Section 4.3.3. 

Testing was limited in scope to the modified portion of the Test ACT computers 
(ACCs) and the DDV controlled FBW actuation system. No integration tests with the 
overall Test ACT System or airplane closed loop performance and failure response 
tests have been conducted. 
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32, contain a summary of the tests performed and the applicable test configurations. 
In test Phase I, the initial DDV interface tests were conducted with a Moog-supplied 
DDV module (with known performance deficiencies) using a Lear Siegler supplied DDM 
evaluation brassboard electronics unit very early in the test program. These tests 
provided valuable information that led to further modifications of the Test ACT 
computers. The first modifications of the ACCs were accomplished under FC4 
control. The same DDV interface tests were repeated using a second, improved, DDV 
supplied by Moog. These test results led to further ACC modifications, which were 
accomplished under FC 6 control. The remaining Phase II and Phase III testing was 
then performed with the ACCs under FC6 configuration and the second, improved, 
DDV used in the laboratory FBW actuation system. 


The general test philosophy was to verify that the modified Test ACT System met the 
fundamental performance, fault tolerance, and fault detection requirements listed in 
Table 8 and Figure 33. 
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Figure 29. Lab Test Architecture Simplified Schematic 




TABLE 7. Modified Test ACT System Lab Test Summary 


Test Phase 


Section 


Test Configuration 


I. Direct Drive Valve 
(DDV)lnterface 
Tests 


6. 2. 1.1 • Figure 30 and Figure 29 

• One Lear Siegler DDM evaluation brassboard 

• Four active channels 

• Closed loop control of surface position and DDV 
position 

• First Moog DDV(50E511 S/N1) 

• Actuation system pressurized to 20 684 kN/m 2 
(3000 psi) 

6. 2. 1.2 Configuration 1 

• Figure 31 and Figure 29 

• Two modified Test ACT computers - FC 4 



lui ii iy ui cuiwi i 

• Four active channels 

• Closed loop control of surface position and DDV 
position 

• Second Moog DDV (50E51 1 S/N2) 

• Actuation system pressurized to 20 684 kN/m 2 
(3000 psi) 


Actuation Integration 
and Performance 
Tests 


Configuration 2 

Same as Configuration 1 except: 

• Closed loop control of surface position only. No 
DDV position control loop 

• DDV command loop gain reduced to be 
compatible with revised control loop architecture 

• Figure 32 and Figure 29 

• Two modified Test ACT computers - FC 6 
configuration 

• Four active channels 

• Closed loop control of surface position 

• Second Moog DDV (50E51 1 S/N 2) 

• Actuation system pressurized to 20 684 kN/m 2 
(3000 psi) 


Fault Tests 


Same as Phase II except: 

• One modified Test ACT computer - FC 6 
configuration 

• Two active channels 


Fault Detection and 
Transient Response 
to Failures 


Same as Phase II except: 

• Number of active channels 
dependant on failure condition 
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Figure 31. Modified Test ACT System Servo Amp Diagram With Closed Inner Loop 
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Figure 32. Modified Test ACT System Servo Amp Diagram With Open Inner Loop 




Table 8. Modified Test ACT System Fundamental Requirements 


1 


PERFORMANCE 


• The actuation system shall provide a no load surface rate of 55 deg/sec. 

• The system shall provide an actuation system bandwidth of 30 rad/s. 

• The system shall meet the linearity, hysteresis, and deadband requirements shown in 
Figure 33. 

• The avionics shall provide closed loop control of both surface position and valve position. 

• Both the surface and valve control loops shall have stability margins of 6 dB gain and 30 deg 
phase. The valve control loop shall provide sufficient attenuation at high frequencies to stabi- 
lize a DDV resonance of 200 Hz with 2.5% damping. 


• Steady state currents resulting from null offsets and system misadjustments that exceed 100 
m.A shall be reduced to less than 100 mA. The rate of adjustment sha!! be such that the nor- 
mal response to commands and disturbances is not affected. 


FAULT TOLERANCE 


• Performance characteristics shall be met after the first and second failure of the electronic 
portion of the system. 

• Each electronic channel shall be limited to one half of the full flow. 

FAULT DETECTION 

• The avionics shall provide two executive (i.e., able to shut down an Essential channel) moni- 
tors to detect DDV, actuator, and control loop failures. 

• An actuator loop monitor shall be provided to detect a jammed valve, failed command, and 
failed surface position LVDT. Failure detection and removal shall be in a manner to limit air- 
plane transients resulting from the failure to 1 .0g incremental. 

• A valve loop monitor shall be provided to detect failures of the DDV current amplifier and other 
valve loop electronics. Failures shall be detected and removed in a manner to prevent tripping 
of the actuator loop monitor in any other channel. 

• Both monitors shall react to failures by removing the current drive from the DDV and the hy- 
draulic enable signal in that channel where the failure occurred. Once tripped, the monitors 
shall reset on power-up. 
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Requirements : 

Linearity: Less Than 2% Full Scale 



Figure 33. Modified Test ACT Actuation Hysteresis, Deadband, and Linearity Requirements 
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6.2.1 DIRECT DRIVE VALVE INTERFACE TESTS 


The objective of the Phase I Direct Drive Valve Interface Tests (table 7) was to verify 
the basic design concept to be implemented in the modified Test ACT System. Tests 
included open loop and closed loop tests of steady state gains, step response, and 
frequency response. 

6.2. 1.1 Tests Using Brassboard Electronics 

Refer to Table 7 for the test configuration. 

The following fundamental problem areas were identified: 

1. DDV Nonlinearities 

The DDV exhibited nonlinear characteristics in terms of valve gain and valve 
hysteresis (see fig. 34). 

The increasing gain with desplacement is characteristic of the DDM design, which 
is optimized to produce the specified chip-shear force of 498. 2N (1121bf.) with 
minimum power and weight. The large hysteresis was subsequently determined to 
have been caused in part by an out-of-tolerance part. Both of these 
characteristics would be essentially masked by operation with a high-gain DDV 
position feedback. 

2. Actuation System Limit Cycling 

With zero valve command, the actuation system limit cycled at a frequency of 3.5 
Hz. There was a peak-to-peak amplitude of 0.0127 mm (0.0005 in.) valve travel 
measured with four active channels, increasing to 0.066 mm (0.0026 in.) with only 
one active channel. Suspected cause of this instability was the friction-induced 
valve hysteresis. System stabilization was achieved by increasing the valve loop 
lag compensation filter rolloff frequency from 3.5 rad/s to 10 rad/s. 
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3. DDV Control Loop Instability 


When operating with four and three channels and the control valve approaching 
the null position following surface actuator step input commands, the valve loop 
became unstable. The frequency of the oscillation was approximately 35 Hz with 
a peak-to-peak amplitude of 0.533 mm (0.021 in.) valve travel. This instability 
was eliminated by increasing the current amplifier bandwidth from 100 Hz to 150 
Hz. 


DDV control loop instability was also observed during surface actuator transients 
with valve command inputs approaching full valve travel in one direction only. 
This instability only occurred with four and three channels operative (see fig. 35). 
No detailed analysis or testing was carried out to determine the exact cause. It 
would appear to be associated with an amplifier/current-limiter dynamic 
interaction and/or with an amplifier/DDV gain incompatibility. 

4. DDV Command Mismatch 

The brassboard servo electronics featured valve coil current equalization through 
a cross-channel voting arrangement that effectively compensated mismatch in 
valve commands between channels under steady state and dynamic operating 
conditions. The brick wall architecture of the Test ACT System dictated 
utilization of inline equalization without channel voting. The concept chosen 
provided for reduction of steady state coil currents only. 

The Brassboard electronics provided the opportunity to evaluate the effects of 
channel mismatch due to offsets, gain tolerances, or misadjustments on closed 
loop system performance by allowing operation with or without the voters in the 
control loop. 

The results of this evaluation are shown in Figure 36. The opposing DDM coil 
currents present during operation pointed to the possibility of reduced control 
authority even when operating with four active channels. 
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Figure 35. Actuation System Closed Loop Transient Response to Step Inputs 




DDV Position, mm Surface Position, deg Coil Current, A Coil Current, A Coil Current, A 
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• Three channel Operation 

• 0.05 Hz Command Input 

• Lear Siegler DDM Evaluation Brassboard Electronics 

• Moog DDV 50E51 1 S/N1 


Figure 36. DDV Command Mismatch Evaluation 
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The test was performed with the surface position commands essentially equal and the 
DDV position feedback loops trimmed for zero offsets and equal gains. This led to the 
preliminary conclusion that the significant DDM coil current differences were due to 
the high gains in the DDV command loops amplifying surface position LVDT offsets 
and gain tolerances. 

6.2. 1.2 Tests Using ACCs Modified Per Flight Change 4 

Refer to Table 7 for the test configuration. 

These tests were conducted with a second DDV supplied by Moog. As shown in Figure 
37, this valve exhibited similar nonlinear gain characteristic found in the first DDV. 
However, its hysteresis was approximately 50% of that measured before. The 
improved hysteresis is believed to be due to the improved friction characterictics of 
the second DDV. Valve friction is reflected in the threshold data shown in Figure 38. 

The effect of the various DDV nonlinearities on the overall system performance can be 
described as follows: 

o Valve threshold directly impacts surface actuator hysteresis and may lead to 
system limit cycling. 

o Valve hysteresis includes threshold and electromagnetic effects. Hysteresis loop 
width is a function of valve command amplitude or surface rate. This results in 
an increase in surface position error with respect to surface commands as higher 
surface rates are demanded. 

o Valve nonlinear gain may cause instabilities during system transients conditions. 

It should be noted that all of these effects are effectively masked by the use of a 
high gain DDV position loop closures, with which the test DDV was designed to 
operate. 
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Figure 37. Gain and Hysteresis for Second DDV 
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• Four Coil Operation 

• No Valve Position Feedback 

• F * 0.02 Hz 

• Moog DDV 50E51 1 S/N2 
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Figure 38. DDV Threshold — Valve Null Region 
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Testing identified the following problems: 


1. DDV Command Signal Mismatch 

As could be expected, the results of this test, shown in Figure 39 resemble those 
reported in Section 6. 2. 1.1; that is, significant different and opposing DDM coil 
currents were present during transient as well as during short time steady-state 
commands. As illustrated in Figure 39, the DDV command signal mismatches 
caused a significant reduction of control authority resulting in sluggish surface 
response to command inputs. In addition, maximum attainable valve travel was 
limited to the equivalent of 65% of rated flow in one direction and of 75% of 
rated flow in the other direction with four channel operation. The duration of 
the steady-state commands was not iong enough for complete current 
equalization to take place. However, as shown in Figure 39, the test data show 
evidence of the initial equalization process. 

2. DDV Control Loop Instability 

The instability was characterized by an approximately 24 Hz limit cycle 
oscillation with a peak-to-peak amplitude of 0.22 mm valve travel (see fig. 39). 
No detailed anaylsis or testing was carried out to determine the exact cause. It 
would appear to be associated with an amplifier/current-limiter dynamic 
interaction and/or with an amplifier/DDV gain incompatibility. 

3. Monitor Failure Sensing 

Mismatch in valve command signals appeared as failures to the inline servo loop 
monitors resulting in disable signals of the channel(s) where the apparent failure 
sensing occured. 

DDV interface testing completed so far indicated that the electronic servo 
architecture was inadequate to achieve satisfactory actuation system performance. It 
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Essential Surface DDV 

Command, V Position, deg Position, mm Coil Current, A Coil Current, A Coil Current, A Coil Current, A 




appeared that a system modification was required to eliminate or at least reduce the 
DDV command signal mismatch. The following three concepts were discussed: 


1. A voting arrangement similar to that used in the DDM evaluation brassboard. 

This concept would violate the brick wall architecture of the Test ACT System 
and was therefore not acceptable. 

2. A reduction in DDV position feedback gain with a corresponding reduction in 
feed forward Essential command gain. This concept would provide less 
amplification of surface actuator position feedback offsets, and gain tolerances, 
and less amplification of essential command tolerances. 




Complete elimination of valve pusition feedback, 
similar to concept 2 above. 
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The third concept was tested using the ACCs modified per FC 4 and DDV position 
feedback eliminated. Refer to Table 7 for the test configuration. 


The test results were encouraging. DDV coil flux mismatches were substantially 
reduced (see fig. 40). The only negative aspect was system limit cycling with zero 
valve command. The limit cycle amplitude was within the modified Test ACT 
actuation system hysteresis requirements of Figure 33 with four channel operation. It 
was decided to modify the ACCs to eliminate DDV position feedback and to subject 
this configuration design to the performance and fault tolerance tests. This ACC 
modification was accomplished under FC 6 and the tests and results are reported in 
Sections 6.2.2 and 6.2.3. 


6.2.2 ACTUATION SYSTEM INTEGRATION AND PERFORMANCE TESTS 


Refer to Table 7 for the test configuration. 

The objective of these tests was to verify that the actuation system met the 
fundamental performance requirements listed in Table 8 with all four channels 
operating. These tests were performed with the ACCs modified per FC 6. 


99 


Essential Surface DDV 

Dmmand, V Position, deg Position, mm Coil Current, A Coil Current, A Coil Current, A Coil Current, A 



• Four Channel Operation 

• ACC Configuration FC 4 Modified 

• Moog DDV 50 E 51 1 S/N 2 


Figure 40. DDV Command Mismatch Evaluation With Open Inner Loop 
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6.2.2. 1 Stability 


The surface actuator control loop demonstrated approximately 14 dB gain margin and 
60 deg phase margin. Although stability was indicated by the measured stability 
margins, the system exhibited limit cycling of approximately 1 Hz with a peak-to-peak 
amplitude of approximately 0.036 deg due to the presence of nonlinearity in the 
control loop. 

No attempt had been made to identify the exact cause or source of the limit cycle 
oscillation; however, it was speculated that the DDV open loop threshold nonlinearity 
(see fig. 38) was a contributor. 

6.2.2.2 Frequency Response 

The system met the 30 rad/s (4.8 Hz) bandwidth requirement (see fig. 41). The 
measured response approximated that of an underdamped second order linear system 
with a natural frequency of 50 rad/s (8 Hz) and a damping ratio of approximately 0.30. 

6.2.2.3 Step Response 

This test was conducted with a square wave signal applied to the Essential computer 
pitch rate inputs. The command to the DDV servo electronics (ESS CMD) was not a 
unit step because of filtering in the Essential control laws. The dynamic response 
characteristics shown in Figure 42 have to be viewed independently since no specific 
requirements were established. 

The test verified the required no load surface rate of 55 deg/s and the capability of 
the electronics to produce full DDV travel. 

6.2.2 A Actuation System Hysteresis 

The result of the system hysteresis test is presented in Figure 43. It is difficult to 
quantify the true system hysteresis because the system limit cycled throughout the 
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Four Channel Operation 



Figure 41. Actuation System Closed Loop Frequency Response 
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• Four Channel Operation 

• ACC Configuration — FC 6 

• Moog DDV 50 E 51 1 S/N 2 



Figure 42. Actuation System Closed Loop Transient Response to Step Inputs 
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test. However, the measured loop width including limit cycle oscillations was within 
the hysteresis requirement of 0.036 deg. 

6.2.2.5 Actuation System Linearity 

The test results are shown in Figure 44. The shaded area represents the linearity 
requirement for the actuation system as defined in Figure 33. 

6.2.3 FAULT TESTS 

Refer to Table 7 for the test configuration. 

The objective of these tests was: 

1. To verify that the actuation system met the fundamental performance 
requirements listed in Table 8 after the loss of two of the four electronic control 
channels. 

2. To verify through failure simulation that the system met the fundamental fault 
detection requirements listed in Table 8 and to determine the system transient 
response to failures. 

6.2.3. 1 Stability 

With two channels operational the system limit cycled at a frequency of approximately 
0.35 Hz, with a peak-to-peak surface amplitude of approximately 0.047 deg. 

6. 2.3.2 Frequency Response 

With two channels operational the system met the 30 rad/s (4.8 Hz) bandwidth 
requirement (see fig. 45). The measured response approximated that of an 
underdamped second order linear system with a natural frequency of 25 rad/s (4 Hz) 
and a damping ratio of approximately 0.50. 
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Two Channel Operation 

Elevator Surface Position/Essential Elevator Command 
Essential Elevator Command Amplitude = 0.30 deq 



Figure 45. Actuation System Closed Loop Frequency Response 







• Two channel Operation 

• ACC Configuration — FC 6 

• Moog DDV 50E51 1 S/N2 
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Figure 46. Actuation System Closed loop Transient Response to Step Inputs 
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6.2.3.3 Step Response 


This test was conducted with a square wave signal applied to the Essential computer 
pitch rate inputs. The surface command to the DDV servo electronics (ESS CMD) was 
not a unit step because of filtering in the Essential control laws. The dynamic 
response characteristics shown in Figure 46 have to be viewed independently since no 
specific requirements were established. The test verified the required no load surface 
rate of 55 deg/s and the capability of the electronics to produce full DDV travel. 

6. 2. 3. 4 Actuation System Hysteresis 

The result of the system hysteresis test is presented in Figure 47. It is difficult to 
quantify the true system hysteresis because the system limit cycled throughout the 
test. The total hysteresis loop width including the limit cycling oscillations was 0.064 
deg with the two channels active. 

6.2.3.5 Actuation System Linearity 

The test results are shown in Figure 48. The shaded area represents the linearity 
requirement for the actuation system as defined in Figure 33. 

6.2.3.6 Channel Null Failure Test 

The test was conducted by interrupting the respective signal path between the servo 
amplifier and the DDM, thereby simulating a failed channel. Three of the four active 
channels were interrupted (i.e., failed sequentially). The following surface transients 
were measured from time of failure (see fig. 49): 

Surface Transient Transient Time 

(de%) (sec) 

First Channel Failure 0.090 0.35 

Second Channel Failure 0.040 4.50 

Third Channel Failure 0.190 0.80 

Typical valve loop monitor response to this failure is shown in Figure 50. 
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Figure 47. Actuation System Hysteresis — Fault Test Results 
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Two Channel Operation 
F = 0.02 Hz 
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Figure 48. Actuation System Linearity — 



I ime, sec • AC Q Configuration — FC 6 

Figure 49. Surface Transient Response to Channel Null Failures • Mo °9 DDV 50E51 1 S/N2 
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• Four Channels Operative 
Before Failure 

• ACC Configuration — FC 6 

• DDV Moog 50E51 1 S/N 2 


Enabled Signal 


Enabled Signal 
Disabled Signal 


Figure 50. Valve Loop Monitor Response to Channel Null Failure 
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Essential Surface DDV Position Value Loop Actuator Loop 

Command, deg Position, deg Monitor Signal Monitor Signal Coil Current, A Coil Current, A 






6.2.3.7 Channel Hardover Failure Test 


Channel hardover was simulated by opening of the surface actuator LVDT in one 
channel during four channel operation with sinusoidal surface commands. The 
resultant surface transient was approximately 0.80 deg (see fig. 51). Typical actuator 
loop monitor response to this failure is also shown in Figure 51. 

6.2.3.8 DDV Chip Shear/Jammed Failure Test 

The DDV was equipped with an external adapter that allowed the insertion of specially 
fabricated metal chips to determine its chip shear capability. The available metal 
chips were .254 mm (0.010 in.) thick by 1.27 mm (.050 in.) and 2.032 mm (0.080 in.) 

.. . 2 .v 

wide respectively witn an ultimate tensii strenth of 1//5 kN/m u&5 uuu psil and 

2 

an ultimate shear strength of 689475 kN/m (100 000 psi). During Moog testing, the 
DDV sheared the smaller chip (.254 mm (0.010 in.) thick by 1.27 mm (.050 in.)wide) at 
a load of 364. 8N (82 lbf) and the larger chip (.254 mm (0.010 in.) thick by 2.032 mm 
(0.080 in.) wide) at a load of 645. ON (145 lbf). The loads were measured in the shear 
test fixture with a force gage. The DDV design chip shear capability was 498. 2N (112 
lbf) with a 1.25 A current in each of the 4 coils. 

During initial tests with the Lear Siegler DDM evaluation brassboard electronics unit 
and four channels operative, the valve was able to shear the smallest of the available 
chips (0.254 by 1.270 mm) at a current of lA/coil (4A total) in one direction and at a 
current of 0.9A/coil (3.6A total) in the other direction (NOTE: The unit was limited to 
1A current output per channel). 

The test was repeated with the modified Test ACT computers in the FC 6 
configuration by inserting the largest of the available chips (0.254 by 2.032 mm) into 
the adapter. As expected, the valve was unable to shear the chip at a total four 
channel current of 4.8A, resulting in a jammed valve. Typical actuator loop monitor 
(C$) response to the jammed valve failure is shown in Figure 52. The test results show 
surface hardover following the valve jam. This was due to the nonimplementation of 
the necessary electronic circuits to the system reconfiguration valve making this valve 
inoperative for this test. Further tests to determine chip shear capability of the 
modified Test ACT System were not performed. 
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Figure 52. Actuator Loop Monitor Response to Jammed DDV Failure 


6.2.4 SIGNIFICANCE OF TEST RESULTS 


The direct drive valves provided by Moog are derivatives of a valve used in the 3AS 39 
fighter. The 3AS 39 computer architecture incorporates cross-channel voting to 
eliminate flux fight in the DDM. This permits the use of DDV position feedback, 
which substantially reduces DDV hysteresis effects on system performance. The Moog 
DDV was not designed to be used in the nonvoted system in the Test ACT program. 
However, the S/N2 Moog DDV, operating without position feedback, was successfully 
integrated in the modified Test ACT System. 
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7.0 CONCLUSIONS AND RECOMMENDATIONS 


The primary objective of the Test ACT System laboratory tests was to verify and 
validate the system concept, hardware, and software. The initial lab tests were open 
loop hardware tests of the Test ACT System as designed and built. These tests 
examined EMI and power transient/quality susceptibility, control panel operation, 
input/output interfaces, Primary system hardware monitors, Essential control laws, 
Essential PAS/FBW monitors, and Primary system output voting. During the course of 
the testing, minor problems were uncovered and corrected. Several problems that 
were discovered would have to be fixed for a production/certificable system but were 
not corrected because they were considered acceptable for the test system. These 
problems had to do with the system status display and response to power failures or 
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equalization function. The issue was dropped when the decision was made to change to 
a different actuation scheme. In general the hardware and all major functions worked 
well. 


The original test plan included significantly more software tests than were actually 
performed, but the software tests were truncated when the project decision was made 
to change the actuation scheme. Major software tests were run. The initial software 
testing was also open loop. These tests examined pitch control laws, wing load 
alleviation, signal selection/fault detection (SSFD), and output management. In 
general the software was well designed and implemented, and only minor problems 
were uncovered. 

The Test ACT System as originally designed and built utilized four force-summed 
secondary servos. These servos were the means of combining the four independent 
commands into a single command for the elevator, and were a failure detection/voting 
plane element of the system. It subsequently appeared that further benefits would be 
available to ACT and FBW if an actuation concept could be developed that allowed the 
electric signals to be carried closer to the control surface than is possible with 
secondary servos. An opportunity arose near the end of the project to examine a new 
actuation concept that became a good candidate FBW system element because of 
advances in solid state electronics and magnetic materials, namely the direct drive 
valve (DDV). The Test ACT System was modified to interface with the direct drive 
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valve modules. The first DDV was tested with brassboard electronics while the Test 
ACT System ACCs were being modified to interface with the DDV. This initial testing 
identified problem areas with DDV nonlinearities, valve friction induced limit cycling, 
DDV control loop instability, and channel command mismatch. The modified Test ACT 
System ACCs were used to drive the second DDV, which had significantly improved 
static performance characteristics. The test results were encouraging. The second 
DDV was successfully integrated into the Test ACT architecture. Furthermore, it met 
all of the performance requirements including the system hysteresis and deadband 
requirement. The deadband requirement is particularly significant because force 
summed secondary servos have historically had problems in meeting the kind of 
deadband requirements imposed by relaxed stability control systems. 

The other DDV issue investigated was the ability to detect and isolate failures. Some 
simple schemes for failure detection were tested but were not completely 
satisfactory. Solutions to the problems that remained would have required further 
modification of the ACCs. This was beyond the scope of the available funding. 

The Test ACT System architecture continues to appear promising for ACT/FBW 
applications in systems that must be immune to worst case generic digital faults, and 
be able to tolerate two sequential nongeneric faults with no reduction in performance. 
The challenge in such an implementation would be to keep the analog element 
sufficiently simple to achieve the necessary reliability. 

The direct drive valve appears to promise signficant reductions in FBW system 
complexity, although much work remains to develop the best system architecture and 
to prove the performance for commercial applications. The servo electronics would 
apparently have to be designed for the DDV nonlinearities and friction characteristics. 
The near "brick-wall" concept employed in the Test ACT System may not be 
compatible with multiple coil DDVs since command mismatches between the channels 
result in reduced control authority and/or channel shutdowns due to failure monitor 
tripping. 
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